@dxos/client-services 0.1.25 → 0.1.27-next.a0dff21

package/dist/lib/node/packlets/testing/index.cjs

@@ -59,10 +59,53 @@ var createMockCredential = async ({ signer, issuer }) => (0, import_credentials.
   }
 });
 
+// packages/sdk/client-services/src/packlets/testing/invitation-utils.ts
+var import_node_assert = __toESM(require("node:assert"));
+var import_async = require("@dxos/async");
+var import_debug = require("@dxos/debug");
+var import_services = require("@dxos/protocols/proto/dxos/client/services");
+var performInvitation = async (host, guest, context) => {
+  const done1 = new import_async.Trigger();
+  const done2 = new import_async.Trigger();
+  const observable1 = await host.createInvitation(context, {
+    type: import_services.Invitation.Type.INTERACTIVE_TESTING
+  });
+  observable1.subscribe({
+    onConnecting: async (invitation1) => {
+      const observable2 = await guest.acceptInvitation(invitation1, {
+        type: import_services.Invitation.Type.INTERACTIVE_TESTING
+      });
+      observable2.subscribe({
+        onConnecting: async (invitation2) => {
+          (0, import_node_assert.default)(invitation1.swarmKey.equals(invitation2.swarmKey));
+        },
+        onConnected: async (invitation2) => {
+        },
+        onSuccess: (invitation) => {
+          done2.wake(invitation);
+        },
+        onCancelled: () => (0, import_debug.raise)(new Error()),
+        onTimeout: (err) => (0, import_debug.raise)(err),
+        onError: (err) => (0, import_debug.raise)(err)
+      });
+    },
+    onConnected: async (invitation1) => {
+    },
+    onCancelled: () => (0, import_debug.raise)(new Error("cancelled")),
+    onSuccess: (invitation) => {
+      done1.wake(invitation);
+    },
+    onTimeout: (err) => (0, import_debug.raise)(err),
+    onError: (err) => (0, import_debug.raise)(err)
+  });
+  await done1.wait();
+  await done2.wait();
+};
+
 // packages/sdk/client-services/src/packlets/testing/test-builder.ts
 var import_credentials13 = require("@dxos/credentials");
-var import_echo_db6 = require("@dxos/echo-db");
-var import_testing = require("@dxos/echo-db/testing");
+var import_echo_pipeline6 = require("@dxos/echo-pipeline");
+var import_testing = require("@dxos/echo-pipeline/testing");
 var import_feed_store5 = require("@dxos/feed-store");
 var import_keyring2 = require("@dxos/keyring");
 var import_messaging3 = require("@dxos/messaging");
@@ -70,16 +113,16 @@ var import_network_manager6 = require("@dxos/network-manager");
 var import_random_access_storage2 = require("@dxos/random-access-storage");
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_async11 = require("@dxos/async");
-var import_credentials11 = require("@dxos/credentials");
-var import_debug3 = require("@dxos/debug");
-var import_echo_db3 = require("@dxos/echo-db");
+var import_async12 = require("@dxos/async");
+var import_credentials12 = require("@dxos/credentials");
+var import_debug5 = require("@dxos/debug");
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
 var import_log10 = require("@dxos/log");
 
 // packages/sdk/client-services/src/packlets/identity/authenticator.ts
-var import_async = require("@dxos/async");
+var import_async2 = require("@dxos/async");
 var import_context = require("@dxos/context");
 var import_credentials2 = require("@dxos/credentials");
 var import_log = require("@dxos/log");
@@ -149,7 +192,7 @@ var TrustedKeySetAuthVerifier = class {
         });
         return true;
       }
-      const trigger = new import_async.Trigger();
+      const trigger = new import_async2.Trigger();
       this._ctx.onDispose(() => {
         trigger.wake(false);
       });
@@ -193,17 +236,17 @@ var TrustedKeySetAuthVerifier = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
-var import_node_assert = __toESM(require("node:assert"));
-var import_async2 = require("@dxos/async");
+var import_node_assert2 = __toESM(require("node:assert"));
+var import_async3 = require("@dxos/async");
 var import_credentials3 = require("@dxos/credentials");
-var import_debug = require("@dxos/debug");
+var import_debug2 = require("@dxos/debug");
 var import_feed_store = require("@dxos/feed-store");
 var import_log2 = require("@dxos/log");
 var import_credentials4 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var AUTH_TIMEOUT = 3e4;
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey }) {
-    this.stateUpdate = new import_async2.Event();
+    this.stateUpdate = new import_async3.Event();
     this.space = space;
     this._signer = signer;
     this.identityKey = identityKey;
@@ -266,8 +309,8 @@ var Identity = class {
     var _a, _b;
     return {
       deviceKey: this.deviceKey,
-      controlFeedKey: (_a = this.space.controlFeedKey) != null ? _a : (0, import_debug.failUndefined)(),
-      dataFeedKey: (_b = this.space.dataFeedKey) != null ? _b : (0, import_debug.failUndefined)()
+      controlFeedKey: (_a = this.space.controlFeedKey) != null ? _a : (0, import_debug2.failUndefined)(),
+      dataFeedKey: (_b = this.space.dataFeedKey) != null ? _b : (0, import_debug2.failUndefined)()
     };
   }
   /**
@@ -275,7 +318,7 @@ var Identity = class {
   * Requires identity to be ready.
   */
   getIdentityCredentialSigner() {
-    (0, import_node_assert.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
+    (0, import_node_assert2.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
     return (0, import_credentials3.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
   }
   /**
@@ -336,8 +379,8 @@ var Identity = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
-var import_node_assert2 = __toESM(require("node:assert"));
-var import_async3 = require("@dxos/async");
+var import_node_assert3 = __toESM(require("node:assert"));
+var import_async4 = require("@dxos/async");
 var import_credentials5 = require("@dxos/credentials");
 var import_log3 = require("@dxos/log");
 var import_credentials6 = require("@dxos/protocols/proto/dxos/halo/credentials");
@@ -350,7 +393,7 @@ var IdentityManager = class {
     this._keyring = _keyring;
     this._feedStore = _feedStore;
     this._spaceManager = _spaceManager;
-    this.stateUpdate = new import_async3.Event();
+    this.stateUpdate = new import_async4.Event();
   }
   get identity() {
     return this._identity;
@@ -378,7 +421,7 @@ var IdentityManager = class {
     await ((_a = this._identity) == null ? void 0 : _a.close());
   }
   async createIdentity({ displayName } = {}) {
-    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
+    (0, import_node_assert3.default)(!this._identity, "Identity already exists.");
     (0, import_log3.log)("creating identity...", {}, {
       file: "identity-manager.ts",
       line: 78,
@@ -447,7 +490,7 @@ var IdentityManager = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
+    (0, import_node_assert3.default)(!this._identity, "Identity already exists.");
     const identityRecord = {
       identityKey: params.identityKey,
       deviceKey: params.deviceKey,
@@ -476,7 +519,7 @@ var IdentityManager = class {
     return identity;
   }
   async _constructIdentity(identityRecord) {
-    (0, import_node_assert2.default)(!this._identity);
+    (0, import_node_assert3.default)(!this._identity);
     (0, import_log3.log)("constructing identity", {
       identityRecord
     }, {
@@ -531,32 +574,80 @@ var IdentityManager = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/identity/identity-service.ts
+var import_node_assert4 = __toESM(require("node:assert"));
+var import_codec_protobuf = require("@dxos/codec-protobuf");
+var import_credentials7 = require("@dxos/credentials");
+var import_debug3 = require("@dxos/debug");
+var IdentityServiceImpl = class {
+  // TODO(wittjosiah): Remove dependency on service context.
+  constructor(_serviceContext) {
+    this._serviceContext = _serviceContext;
+  }
+  async createIdentity(request) {
+    await this._serviceContext.createIdentity(request);
+    return this._getIdentity();
+  }
+  async recoverIdentity(request) {
+    return (0, import_debug3.todo)();
+  }
+  queryIdentity() {
+    return new import_codec_protobuf.Stream(({ next }) => {
+      const emitNext = () => next({
+        identity: this._getIdentity()
+      });
+      emitNext();
+      return this._serviceContext.identityManager.stateUpdate.on(emitNext);
+    });
+  }
+  _getIdentity() {
+    if (!this._serviceContext.identityManager.identity) {
+      return void 0;
+    }
+    return {
+      identityKey: this._serviceContext.identityManager.identity.identityKey,
+      spaceKey: this._serviceContext.identityManager.identity.space.key,
+      profile: this._serviceContext.identityManager.identity.profileDocument
+    };
+  }
+  async signPresentation({ presentation, nonce }) {
+    (0, import_node_assert4.default)(this._serviceContext.identityManager.identity, "Identity not initialized.");
+    return await (0, import_credentials7.signPresentation)({
+      presentation,
+      signer: this._serviceContext.keyring,
+      signerKey: this._serviceContext.identityManager.identity.deviceKey,
+      chain: this._serviceContext.identityManager.identity.deviceCredentialChain,
+      nonce
+    });
+  }
+};
+
 // packages/sdk/client-services/src/packlets/invitations/encoder.ts
 var import_base_x = __toESM(require("base-x"));
 var import_protocols2 = require("@dxos/protocols");
 var base62 = (0, import_base_x.default)("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
 var codec = import_protocols2.schema.getCodecForType("dxos.client.services.Invitation");
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
-var import_node_assert3 = __toESM(require("node:assert"));
-var import_async5 = require("@dxos/async");
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
+var import_node_assert5 = __toESM(require("node:assert"));
+var import_async6 = require("@dxos/async");
 var import_context2 = require("@dxos/context");
-var import_credentials7 = require("@dxos/credentials");
+var import_credentials8 = require("@dxos/credentials");
 var import_keys2 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
 var import_protocols3 = require("@dxos/protocols");
-var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
 
 // packages/sdk/client-services/src/packlets/invitations/invitations.ts
-var import_async4 = require("@dxos/async");
-var import_services = require("@dxos/protocols/proto/dxos/client/services");
+var import_async5 = require("@dxos/async");
+var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var AUTHENTICATION_CODE_LENGTH = 6;
 var INVITATION_TIMEOUT = 3 * 6e4;
 var ON_CLOSE_DELAY = 1e3;
-var InvitationObservableProvider = class extends import_async4.CancellableObservableProvider {
+var InvitationObservableProvider = class extends import_async5.CancellableObservableProvider {
   get invitation() {
     return this._invitation;
   }
@@ -583,8 +674,8 @@ var AbstractInvitationsHandler = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
-var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
+var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
   // prettier-ignore
   constructor(_params) {
     super(_params.networkManager);
@@ -595,13 +686,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   */
   createInvitation(context, options) {
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert3.default)(type !== import_services2.Invitation.Type.OFFLINE);
+    (0, import_node_assert5.default)(type !== import_services3.Invitation.Type.OFFLINE);
     const identity = this._params.getIdentity();
     const invitation = {
       type,
       invitationId: import_keys2.PublicKey.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : import_keys2.PublicKey.random(),
-      authenticationCode: (0, import_credentials7.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+      authenticationCode: (0, import_credentials8.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
     };
     const ctx = new import_context2.Context({
       onError: (err) => {
@@ -613,14 +704,14 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       await ctx.dispose();
     });
     let authenticationCode;
-    const complete = new import_async5.Trigger();
+    const complete = new import_async6.Trigger();
     const createExtension = () => new HostHaloInvitationExtension({
       requestAdmission: async () => {
         var _a, _b;
         (0, import_log4.log)("responding with admission offer", {
           host: identity.deviceKey
         }, {
-          file: "halo-invitations-handler.ts",
+          file: "device-invitations-handler.ts",
           line: 91,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -636,7 +727,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         (0, import_log4.log)("received authentication request", {
           authenticationCode: code
         }, {
-          file: "halo-invitations-handler.ts",
+          file: "device-invitations-handler.ts",
           line: 105,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -649,7 +740,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
       presentAdmissionCredentials: async (credentials) => {
         try {
-          if (invitation.type !== import_services2.Invitation.Type.INTERACTIVE_TESTING) {
+          if (invitation.type !== import_services3.Invitation.Type.INTERACTIVE_TESTING) {
             if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
               throw new Error(`invalid authentication code: ${authenticationCode}`);
             }
@@ -658,7 +749,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             host: identity.deviceKey,
             guest: credentials.deviceKey
           }, {
-            file: "halo-invitations-handler.ts",
+            file: "device-invitations-handler.ts",
             line: 120,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -671,13 +762,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         }
       },
       onOpen: () => {
-        (0, import_async5.scheduleTask)(ctx, async () => {
+        (0, import_async6.scheduleTask)(ctx, async () => {
           var _a, _b;
           try {
             (0, import_log4.log)("connected", {
               host: identity.deviceKey
             }, {
-              file: "halo-invitations-handler.ts",
+              file: "device-invitations-handler.ts",
               line: 136,
               scope: this,
               callSite: (f, a) => f(...a)
@@ -690,7 +781,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               host: identity.deviceKey,
               guest: deviceKey
             }, {
-              file: "halo-invitations-handler.ts",
+              file: "device-invitations-handler.ts",
               line: 139,
               scope: this,
               callSite: (f, a) => f(...a)
@@ -699,7 +790,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           } catch (err) {
             if (!observable.cancelled) {
               import_log4.log.error("failed", err, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -707,13 +798,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               observable.callback.onError(err);
             }
           } finally {
-            await (0, import_async5.sleep)(ON_CLOSE_DELAY);
+            await (0, import_async6.sleep)(ON_CLOSE_DELAY);
             await ctx.dispose();
           }
         });
       }
     });
-    (0, import_async5.scheduleTask)(ctx, async () => {
+    (0, import_async6.scheduleTask)(ctx, async () => {
       var _a, _b;
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
@@ -742,7 +833,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async5.Trigger();
+    const authenticated = new import_async6.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -753,33 +844,33 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async5.Trigger();
+    const complete = new import_async6.Trigger();
     const createExtension = () => {
       const extension = new GuestHaloInvitationExtension({
         onOpen: () => {
-          (0, import_async5.scheduleTask)(ctx, async () => {
+          (0, import_async6.scheduleTask)(ctx, async () => {
             var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
               (0, import_log4.log)("connected", {}, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 214,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               (0, import_log4.log)("sending admission request", {}, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 218,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
-              if (invitation.type === void 0 || invitation.type === import_services2.Invitation.Type.INTERACTIVE) {
+              if (invitation.type === void 0 || invitation.type === import_services3.Invitation.Type.INTERACTIVE) {
                 (0, import_log4.log)("guest waiting for authentication code...", {}, {
-                  file: "halo-invitations-handler.ts",
+                  file: "device-invitations-handler.ts",
                   line: 225,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -789,7 +880,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                   timeout
                 });
                 (0, import_log4.log)("sending authentication request", {}, {
-                  file: "halo-invitations-handler.ts",
+                  file: "device-invitations-handler.ts",
                   line: 228,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -807,7 +898,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 controlFeedKey,
                 dataFeedKey
               }, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 237,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -829,7 +920,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 256,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -838,7 +929,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 import_log4.log.warn("auth failed", err, {
-                  file: "halo-invitations-handler.ts",
+                  file: "device-invitations-handler.ts",
                   line: 260,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -853,9 +944,9 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async5.scheduleTask)(ctx, async () => {
+    (0, import_async6.scheduleTask)(ctx, async () => {
       var _a, _b;
-      (0, import_node_assert3.default)(invitation.swarmKey);
+      (0, import_node_assert5.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -925,15 +1016,15 @@ var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
-var import_async6 = require("@dxos/async");
+var import_async7 = require("@dxos/async");
 var import_log5 = require("@dxos/log");
-var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-var import_node_assert4 = __toESM(require("node:assert"));
-var import_codec_protobuf = require("@dxos/codec-protobuf");
+var import_node_assert6 = __toESM(require("node:assert"));
+var import_codec_protobuf2 = require("@dxos/codec-protobuf");
 var import_log6 = require("@dxos/log");
-var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var AbstractInvitationsService = class {
   // prettier-ignore
   constructor(_identityManager, _getInvitationsHandler) {
@@ -950,7 +1041,7 @@ var AbstractInvitationsService = class {
     };
   }
   createInvitation(invitation) {
-    return new import_codec_protobuf.Stream(({ next, close }) => {
+    return new import_codec_protobuf2.Stream(({ next, close }) => {
       const invitationsHandler = this._getInvitationsHandler();
       const context = this.getContext(invitation);
       (0, import_log6.log)("stream opened", this.getLoggingContext(), {
@@ -960,48 +1051,49 @@ var AbstractInvitationsService = class {
         callSite: (f, a) => f(...a)
       });
       let invitationId;
-      const { type, swarmKey } = invitation;
+      const { type, swarmKey, authMethod } = invitation;
       const observable = invitationsHandler.createInvitation(context, {
         type,
-        swarmKey
+        swarmKey,
+        authMethod
       });
       observable.subscribe({
         onConnecting: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
+          (0, import_node_assert6.default)(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._createInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = import_services4.Invitation.State.CONNECTING;
+          invitation2.state = import_services5.Invitation.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
-          invitation2.state = import_services4.Invitation.State.CONNECTED;
+          (0, import_node_assert6.default)(invitation2.invitationId);
+          invitation2.state = import_services5.Invitation.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
-          invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+          (0, import_node_assert6.default)(invitation2.invitationId);
+          invitation2.state = import_services5.Invitation.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
-          invitation2.state = import_services4.Invitation.State.SUCCESS;
+          (0, import_node_assert6.default)(invitation2.invitationId);
+          invitation2.state = import_services5.Invitation.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          (0, import_node_assert4.default)(invitationId);
+          (0, import_node_assert6.default)(invitationId);
           invitation.invitationId = invitationId;
-          invitation.state = import_services4.Invitation.State.CANCELLED;
+          invitation.state = import_services5.Invitation.State.CANCELLED;
           next(invitation);
           close();
         },
         onTimeout: (err) => {
-          invitation.state = import_services4.Invitation.State.TIMEOUT;
+          invitation.state = import_services5.Invitation.State.TIMEOUT;
           close(err);
         },
         onError: (err) => {
-          invitation.state = import_services4.Invitation.State.ERROR;
+          invitation.state = import_services5.Invitation.State.ERROR;
           close(err);
         }
       });
@@ -1030,7 +1122,7 @@ var AbstractInvitationsService = class {
     });
   }
   acceptInvitation(invitation, options) {
-    return new import_codec_protobuf.Stream(({ next, close }) => {
+    return new import_codec_protobuf2.Stream(({ next, close }) => {
       (0, import_log6.log)("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
         line: 104,
@@ -1042,40 +1134,40 @@ var AbstractInvitationsService = class {
       const observable = invitationsHandler.acceptInvitation(invitation, options);
       observable.subscribe({
         onConnecting: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
+          (0, import_node_assert6.default)(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._acceptInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = import_services4.Invitation.State.CONNECTING;
+          invitation2.state = import_services5.Invitation.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
-          invitation2.state = import_services4.Invitation.State.CONNECTED;
+          (0, import_node_assert6.default)(invitation2.invitationId);
+          invitation2.state = import_services5.Invitation.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          (0, import_node_assert4.default)(invitation2.invitationId);
-          invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+          (0, import_node_assert6.default)(invitation2.invitationId);
+          invitation2.state = import_services5.Invitation.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          invitation2.state = import_services4.Invitation.State.SUCCESS;
+          invitation2.state = import_services5.Invitation.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          (0, import_node_assert4.default)(invitationId);
+          (0, import_node_assert6.default)(invitationId);
           invitation.invitationId = invitationId;
-          invitation.state = import_services4.Invitation.State.CANCELLED;
+          invitation.state = import_services5.Invitation.State.CANCELLED;
           next(invitation);
           close();
         },
         onTimeout: (err) => {
-          invitation.state = import_services4.Invitation.State.TIMEOUT;
+          invitation.state = import_services5.Invitation.State.TIMEOUT;
           close(err);
         },
         onError: (err) => {
-          invitation.state = import_services4.Invitation.State.ERROR;
+          invitation.state = import_services5.Invitation.State.ERROR;
           close(err);
         }
       });
@@ -1110,7 +1202,7 @@ var AbstractInvitationsService = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert4.default)(invitationId);
+    (0, import_node_assert6.default)(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
       import_log6.log.warn("invalid invitation", {
@@ -1133,7 +1225,7 @@ var AbstractInvitationsService = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert4.default)(invitation.invitationId);
+    (0, import_node_assert6.default)(invitation.invitationId);
     const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
     if (!observable) {
       import_log6.log.warn("invalid invitation", {
@@ -1150,8 +1242,8 @@ var AbstractInvitationsService = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-service.ts
-var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-service.ts
+var DeviceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler) {
     super(identityManager, () => invitationsHandler);
@@ -1162,16 +1254,16 @@ var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-var import_node_assert5 = __toESM(require("node:assert"));
-var import_async7 = require("@dxos/async");
+var import_node_assert7 = __toESM(require("node:assert"));
+var import_async8 = require("@dxos/async");
 var import_context3 = require("@dxos/context");
-var import_credentials8 = require("@dxos/credentials");
+var import_credentials9 = require("@dxos/credentials");
 var import_feed_store2 = require("@dxos/feed-store");
 var import_keys3 = require("@dxos/keys");
 var import_log7 = require("@dxos/log");
 var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols4 = require("@dxos/protocols");
-var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations4 = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport2 = require("@dxos/teleport");
 var MAX_OTP_ATTEMPTS = 3;
@@ -1186,16 +1278,19 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   * Creates an invitation and listens for a join request from the invited (guest) peer.
   */
   createInvitation(space, options) {
+    var _a;
     let swarmConnection;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert5.default)(type !== import_services5.Invitation.Type.OFFLINE);
-    (0, import_node_assert5.default)(space);
+    (0, import_node_assert7.default)(type !== import_services6.Invitation.Type.OFFLINE);
+    (0, import_node_assert7.default)(space);
     const invitation = {
       type,
       invitationId: import_keys3.PublicKey.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : import_keys3.PublicKey.random(),
       spaceKey: space.key,
-      authenticationCode: (0, import_credentials8.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+      authMethod: (_a = options == null ? void 0 : options.authMethod) != null ? _a : import_invitations4.AuthMethod.SHARED_SECRET,
+      authenticationCode: (0, import_credentials9.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+      // TODO(dmaretskyi): Don't generate if authMethod === NONE .
     };
     const ctx = new import_context3.Context({
       onError: (err) => {
@@ -1206,44 +1301,76 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     const observable = new InvitationObservableProvider(async () => {
       await (swarmConnection == null ? void 0 : swarmConnection.close());
     });
-    let authenticationCode;
+    let authenticationPassed = false;
     let authenticationRetry = 0;
     const createExtension = () => {
-      const complete = new import_async7.Trigger();
+      const complete = new import_async8.Trigger();
       let guestProfile;
       const hostInvitationExtension = new HostSpaceInvitationExtension({
         introduce: async ({ profile }) => {
-          var _a, _b;
+          var _a2, _b;
           (0, import_log7.log)("guest introduced itself", {
             guestProfile: profile,
             host: this._signingContext.deviceKey,
             spaceKey: space.key
           }, {
             file: "space-invitations-handler.ts",
-            line: 98,
+            line: 101,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           guestProfile = profile;
-          (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
+          (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
+          return {
+            spaceKey: type === import_services6.Invitation.Type.INTERACTIVE_TESTING || type === import_services6.Invitation.Type.MULTIUSE_TESTING ? space.key : void 0,
+            authMethod: invitation.authMethod
+          };
         },
         authenticate: async ({ authenticationCode: code }) => {
           (0, import_log7.log)("received authentication request", {
             authenticationCode: code
           }, {
             file: "space-invitations-handler.ts",
-            line: 112,
+            line: 123,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           let status = import_invitations4.AuthenticationResponse.Status.OK;
-          if (invitation.authenticationCode) {
-            if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-              status = import_invitations4.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-            } else if (code !== invitation.authenticationCode) {
-              status = import_invitations4.AuthenticationResponse.Status.INVALID_OTP;
-            } else {
-              authenticationCode = code;
+          switch (invitation.authMethod) {
+            case import_invitations4.AuthMethod.NONE: {
+              (0, import_log7.log)("authentication not required", {}, {
+                file: "space-invitations-handler.ts",
+                line: 128,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: import_invitations4.AuthenticationResponse.Status.OK
+              };
+            }
+            case import_invitations4.AuthMethod.SHARED_SECRET: {
+              if (invitation.authenticationCode) {
+                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = import_invitations4.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== invitation.authenticationCode) {
+                  status = import_invitations4.AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              import_log7.log.error("invalid authentication method", {
+                authMethod: invitation.authMethod
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 144,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = import_invitations4.AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
             }
           }
           return {
@@ -1252,24 +1379,22 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         },
         requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
           try {
-            if (invitation.type !== import_services5.Invitation.Type.INTERACTIVE_TESTING && invitation.type !== import_services5.Invitation.Type.MULTIUSE_TESTING) {
-              if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
-                throw new Error(`invalid authentication code: ${authenticationCode}`);
-              }
+            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
+              throw new Error("Not authenticated");
             }
             (0, import_log7.log)("writing guest credentials", {
               host: this._signingContext.deviceKey,
               guest: deviceKey
             }, {
               file: "space-invitations-handler.ts",
-              line: 139,
+              line: 160,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-            (0, import_node_assert5.default)(credentials[0].credential);
+            const credentials = await (0, import_credentials9.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+            (0, import_node_assert7.default)(credentials[0].credential);
             const spaceMemberCredential = credentials[0].credential.credential;
-            (0, import_node_assert5.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+            (0, import_node_assert7.default)((0, import_credentials9.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
             await (0, import_feed_store2.writeMessages)(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
@@ -1281,18 +1406,18 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           }
         },
         onOpen: () => {
-          (0, import_async7.scheduleTask)(ctx, async () => {
-            var _a, _b;
+          (0, import_async8.scheduleTask)(ctx, async () => {
+            var _a2, _b;
             try {
               (0, import_log7.log)("connected", {
                 host: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 170,
+                line: 191,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+              (_b = (_a2 = observable.callback).onConnected) == null ? void 0 : _b.call(_a2, invitation);
               const deviceKey = await complete.wait({
                 timeout
               });
@@ -1301,7 +1426,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 173,
+                line: 194,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1310,15 +1435,15 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 import_log7.log.error("failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 177,
+                  line: 198,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 observable.callback.onError(err);
               }
             } finally {
-              if (type !== import_services5.Invitation.Type.MULTIUSE_TESTING) {
-                await (0, import_async7.sleep)(ON_CLOSE_DELAY);
+              if (type !== import_services6.Invitation.Type.MULTIUSE_TESTING) {
+                await (0, import_async8.sleep)(ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
             }
@@ -1327,8 +1452,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return hostInvitationExtension;
     };
-    (0, import_async7.scheduleTask)(ctx, async () => {
-      var _a, _b;
+    (0, import_async8.scheduleTask)(ctx, async () => {
+      var _a2, _b;
       const topic = invitation.swarmKey;
       const swarmConnection2 = await this._networkManager.joinSwarm({
         topic,
@@ -1339,7 +1464,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         topology: new import_network_manager2.StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection2.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+      (_b = (_a2 = observable.callback).onConnecting) == null ? void 0 : _b.call(_a2, invitation);
     });
     return observable;
   }
@@ -1356,7 +1481,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async7.Trigger();
+    const authenticated = new import_async8.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1366,12 +1491,12 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async7.Trigger();
+    const complete = new import_async8.Trigger();
     const createExtension = () => {
       const extension = new GuestSpaceInvitationExtension({
         onOpen: () => {
-          (0, import_async7.scheduleTask)(ctx, async () => {
-            var _a, _b, _c, _d;
+          (0, import_async8.scheduleTask)(ctx, async () => {
+            var _a, _b, _c, _d, _e, _f;
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
@@ -1380,7 +1505,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 250,
+                line: 271,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1389,28 +1514,42 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 254,
+                line: 275,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              await extension.rpc.SpaceHostService.introduce({
+              const introductionResponse = await extension.rpc.SpaceHostService.introduce({
                 profile: this._signingContext.profile
               });
-              if (invitation.type === void 0 || invitation.type === import_services5.Invitation.Type.INTERACTIVE) {
+              (0, import_log7.log)("introduce response", {
+                guest: this._signingContext.deviceKey,
+                response: introductionResponse
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 279,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              invitation.authMethod = introductionResponse.authMethod;
+              if (introductionResponse.spaceKey) {
+                invitation.spaceKey = introductionResponse.spaceKey;
+              }
+              if (isAuthenticationRequired(invitation)) {
+                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log7.log)("guest waiting for authentication code...", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 263,
+                    line: 293,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
+                  (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation);
                   const authenticationCode = await authenticated.wait({
                     timeout
                   });
                   (0, import_log7.log)("sending authentication request", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 267,
+                    line: 297,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1428,7 +1567,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                         attempt
                       }, {
                         file: "space-invitations-handler.ts",
-                        line: 277,
+                        line: 307,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1443,7 +1582,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 288,
+                line: 318,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1453,9 +1592,9 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 controlFeedKey,
                 dataFeedKey
               });
-              const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
-              (0, import_node_assert5.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              (0, import_node_assert5.default)(credential.subject.id.equals(this._signingContext.identityKey));
+              const assertion = (0, import_credentials9.getCredentialAssertion)(credential);
+              (0, import_node_assert7.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+              (0, import_node_assert7.default)(credential.subject.id.equals(this._signingContext.identityKey));
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
                 genesisFeedKey: assertion.genesisFeedKey
@@ -1466,7 +1605,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 spaceKey: space.key
               }, {
                 file: "space-invitations-handler.ts",
-                line: 310,
+                line: 340,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1475,7 +1614,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 import_log7.log.warn("auth failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 314,
+                  line: 344,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1489,9 +1628,9 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async7.scheduleTask)(ctx, async () => {
+    (0, import_async8.scheduleTask)(ctx, async () => {
       var _a, _b;
-      (0, import_node_assert5.default)(invitation.swarmKey);
+      (0, import_node_assert7.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1510,6 +1649,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_invitations4.AuthMethod.NONE && invitation.type !== import_services6.Invitation.Type.INTERACTIVE_TESTING && invitation.type !== import_services6.Invitation.Type.MULTIUSE_TESTING;
 var HostSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
   constructor(_callbacks) {
     super({
@@ -1560,7 +1700,7 @@ var GuestSpaceInvitationExtension = class extends import_teleport2.RpcExtension
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
-var import_node_assert6 = __toESM(require("node:assert"));
+var import_node_assert8 = __toESM(require("node:assert"));
 var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler, _getSpaceManager) {
@@ -1569,37 +1709,37 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
     this._getSpaceManager = _getSpaceManager;
   }
   getContext(invitation) {
-    (0, import_node_assert6.default)(invitation.spaceKey);
+    (0, import_node_assert8.default)(invitation.spaceKey);
     const spaceManager = this._getSpaceManager();
     const space = spaceManager.spaces.get(invitation.spaceKey);
-    (0, import_node_assert6.default)(space);
+    (0, import_node_assert8.default)(space);
     return space;
   }
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-var import_node_assert8 = __toESM(require("node:assert"));
-var import_async10 = require("@dxos/async");
+var import_node_assert10 = __toESM(require("node:assert"));
+var import_async11 = require("@dxos/async");
 var import_context6 = require("@dxos/context");
-var import_credentials10 = require("@dxos/credentials");
-var import_echo_db2 = require("@dxos/echo-db");
+var import_credentials11 = require("@dxos/credentials");
+var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_keys6 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
 var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
 var import_util4 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var import_async9 = require("@dxos/async");
+var import_async10 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
-var import_debug2 = require("@dxos/debug");
-var import_echo_db = require("@dxos/echo-db");
+var import_debug4 = require("@dxos/debug");
+var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_keys5 = require("@dxos/keys");
-var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util3 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-var import_node_assert7 = __toESM(require("node:assert"));
-var import_async8 = require("@dxos/async");
+var import_node_assert9 = __toESM(require("node:assert"));
+var import_async9 = require("@dxos/async");
 var import_context4 = require("@dxos/context");
 var import_keys4 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
@@ -1611,7 +1751,7 @@ var NOTARIZE_TIMEOUT = 1e4;
 var NotarizationPlugin = class {
   constructor() {
     this._ctx = new import_context4.Context();
-    this._extensionOpened = new import_async8.Event();
+    this._extensionOpened = new import_async9.Event();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new import_util2.ComplexSet(import_keys4.PublicKey.hash);
     this._processCredentialsTriggers = new import_util2.ComplexMap(import_keys4.PublicKey.hash);
@@ -1633,8 +1773,8 @@ var NotarizationPlugin = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert7.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
-    const errors = new import_async8.Trigger();
+    (0, import_node_assert9.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
+    const errors = new import_async9.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
         import_log8.log.warn("Notarization error", {
@@ -1649,7 +1789,7 @@ var NotarizationPlugin = class {
         errors.throw(err);
       }
     });
-    (0, import_async8.scheduleTask)(ctx, () => {
+    (0, import_async9.scheduleTask)(ctx, () => {
       import_log8.log.warn("Notarization timeout", {}, {
         file: "notarization-plugin.ts",
         line: 61,
@@ -1657,11 +1797,11 @@ var NotarizationPlugin = class {
         callSite: (f, a) => f(...a)
       });
       void ctx.dispose();
-      errors.throw(new import_async8.TimeoutError(NOTARIZE_TIMEOUT, "Notarization timed out"));
+      errors.throw(new import_async9.TimeoutError(NOTARIZE_TIMEOUT, "Notarization timed out"));
     }, NOTARIZE_TIMEOUT);
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
-    const notarizeTask = new import_async8.DeferredTask(ctx, async () => {
+    const notarizeTask = new import_async9.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
           import_log8.log.warn("No peers to notarize with", {}, {
@@ -1685,7 +1825,7 @@ var NotarizationPlugin = class {
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async8.scheduleTask)(ctx, () => notarizeTask.schedule(), RETRY_TIMEOUT);
+          (0, import_async9.scheduleTask)(ctx, () => notarizeTask.schedule(), RETRY_TIMEOUT);
           return;
         }
         peersTried.add(peer);
@@ -1747,14 +1887,14 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    (0, import_node_assert7.default)(!this._writer, "Writer already set.");
+    (0, import_node_assert9.default)(!this._writer, "Writer already set.");
     this._writer = writer;
   }
   async _waitUntilProcessed(id) {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await (0, import_util2.entry)(this._processCredentialsTriggers, id).orInsert(new import_async8.Trigger()).value.wait();
+    await (0, import_util2.entry)(this._processCredentialsTriggers, id).orInsert(new import_async9.Trigger()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -1765,7 +1905,7 @@ var NotarizationPlugin = class {
       throw new Error("Writer not set");
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
-      (0, import_node_assert7.default)(credential.id, "Credential must have an id");
+      (0, import_node_assert9.default)(credential.id, "Credential must have an id");
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
@@ -1855,7 +1995,7 @@ var DataSpace = class DataSpace2 {
     this._feedStore = params.feedStore;
     this._metadataStore = params.metadataStore;
     this._signingContext = params.signingContext;
-    this._dataPipelineController = new import_echo_db.DataPipelineControllerImpl({
+    this._dataPipelineController = new import_echo_pipeline.DataPipelineControllerImpl({
       modelFactory: params.modelFactory,
       metadataStore: params.metadataStore,
       snapshotManager: params.snapshotManager,
@@ -1911,7 +2051,7 @@ var DataSpace = class DataSpace2 {
       timeout: CONTROL_PIPELINE_READY_TIMEFRAME
     });
     await this._createWritableFeeds();
-    this.notarizationPlugin.setWriter((0, import_echo_db.createMappedFeedWriter)((credential) => ({
+    this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
       credential: {
         credential
       }
@@ -1932,7 +2072,7 @@ var DataSpace = class DataSpace2 {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials9.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials10.AdmittedFeed.Designation.CONTROL
         }
       }));
     }
@@ -1948,7 +2088,7 @@ var DataSpace = class DataSpace2 {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials9.AdmittedFeed.Designation.DATA
+          designation: import_credentials10.AdmittedFeed.Designation.DATA
         }
       }));
     }
@@ -1959,10 +2099,10 @@ var DataSpace = class DataSpace2 {
   }
 };
 __decorate([
-  (0, import_debug2.timed)(1e4)
+  (0, import_debug4.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
 DataSpace = __decorate([
-  (0, import_async9.trackLeaks)("open", "close")
+  (0, import_async10.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
@@ -1988,7 +2128,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
     this._ctx = new import_context6.Context();
-    this.updated = new import_async10.Event();
+    this.updated = new import_async11.Event();
     this._spaces = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
   }
   // TODO(burdon): Remove.
@@ -2061,10 +2201,10 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     const space = await this._constructSpace(metadata);
-    const credentials = await (0, import_echo_db2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
+    const credentials = await (0, import_echo_pipeline2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_node_assert8.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    (0, import_node_assert10.default)((0, import_credentials11.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
     this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
@@ -2073,7 +2213,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    (0, import_node_assert8.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    (0, import_node_assert10.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey
@@ -2092,7 +2232,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       offlineTimeout: 3e4,
       identityKey: this._signingContext.identityKey
     });
-    const snapshotManager = new import_echo_db2.SnapshotManager(this._snapshotStore);
+    const snapshotManager = new import_echo_pipeline2.SnapshotManager(this._snapshotStore);
     const controlFeed = metadata.controlFeedKey && await this._feedStore.openFeed(metadata.controlFeedKey, {
       writable: true
     });
@@ -2134,19 +2274,19 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
 };
 __decorate2([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpaceManager.prototype, "open", null);
 __decorate2([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpaceManager.prototype, "close", null);
 __decorate2([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
 __decorate2([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
 DataSpaceManager = __decorate2([
-  (0, import_async10.trackLeaks)("open", "close")
+  (0, import_async11.trackLeaks)("open", "close")
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
@@ -2156,30 +2296,30 @@ var ServiceContext = class {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new import_async11.Trigger();
-    this.dataServiceSubscriptions = new import_echo_db3.DataServiceSubscriptions();
-    this.metadataStore = new import_echo_db3.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_db3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.initialized = new import_async12.Trigger();
+    this.dataServiceSubscriptions = new import_echo_pipeline3.DataServiceSubscriptions();
+    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
     this.feedStore = new import_feed_store3.FeedStore({
       factory: new import_feed_store3.FeedFactory({
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_db3.valueEncoding
+          valueEncoding: import_echo_pipeline3.valueEncoding
         }
       })
     });
-    this.spaceManager = new import_echo_db3.SpaceManager({
+    this.spaceManager = new import_echo_pipeline3.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.haloInvitations = new HaloInvitationsHandler({
+    this.deviceInvitations = new DeviceInvitationsHandler({
       networkManager: this.networkManager,
       getIdentity: () => {
         var _a;
-        return (_a = this.identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
+        return (_a = this.identityManager.identity) != null ? _a : (0, import_debug5.failUndefined)();
       },
       acceptIdentity: this._acceptIdentity.bind(this),
       keyring: this.keyring
@@ -2262,7 +2402,7 @@ var ServiceContext = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug5.failUndefined)();
     const signingContext = {
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
@@ -2282,7 +2422,7 @@ var ServiceContext = class {
     this.initialized.wake();
     this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
       process: async (credential) => {
-        const assertion = (0, import_credentials11.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials12.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -2342,227 +2482,30 @@ var ServiceContext = class {
 var import_protocols6 = require("@dxos/protocols");
 var import_rpc = require("@dxos/rpc");
 var clientServiceBundle = (0, import_rpc.createServiceBundle)({
-  HaloInvitationsService: import_protocols6.schema.getService("dxos.client.services.HaloInvitationsService"),
+  SystemService: import_protocols6.schema.getService("dxos.client.services.SystemService"),
+  IdentityService: import_protocols6.schema.getService("dxos.client.services.IdentityService"),
+  DeviceInvitationsService: import_protocols6.schema.getService("dxos.client.services.DeviceInvitationsService"),
   DevicesService: import_protocols6.schema.getService("dxos.client.services.DevicesService"),
   SpaceInvitationsService: import_protocols6.schema.getService("dxos.client.services.SpaceInvitationsService"),
   SpacesService: import_protocols6.schema.getService("dxos.client.services.SpacesService"),
+  DataService: import_protocols6.schema.getService("dxos.echo.service.DataService"),
   NetworkService: import_protocols6.schema.getService("dxos.client.services.NetworkService"),
   // TODO(burdon): Deprecated.
-  SpaceService: import_protocols6.schema.getService("dxos.client.SpaceService"),
-  DataService: import_protocols6.schema.getService("dxos.echo.service.DataService"),
-  ProfileService: import_protocols6.schema.getService("dxos.client.ProfileService"),
-  SystemService: import_protocols6.schema.getService("dxos.client.SystemService"),
   DevtoolsHost: import_protocols6.schema.getService("dxos.devtools.host.DevtoolsHost"),
   TracingService: import_protocols6.schema.getService("dxos.devtools.host.TracingService")
 });
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
+var import_node_assert13 = __toESM(require("node:assert"));
+var import_async23 = require("@dxos/async");
 var import_debug7 = require("@dxos/debug");
 var import_document_model = require("@dxos/document-model");
-var import_echo_db5 = require("@dxos/echo-db");
-var import_log16 = require("@dxos/log");
+var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_log17 = require("@dxos/log");
 var import_model_factory = require("@dxos/model-factory");
-var import_client2 = require("@dxos/protocols/proto/dxos/client");
+var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
 var import_text_model = require("@dxos/text-model");
 
-// packages/sdk/client-services/src/packlets/deprecated/space.ts
-var import_node_assert9 = __toESM(require("node:assert"));
-var import_codec_protobuf2 = require("@dxos/codec-protobuf");
-var import_debug4 = require("@dxos/debug");
-var import_log11 = require("@dxos/log");
-var import_client = require("@dxos/protocols/proto/dxos/client");
-var import_util5 = require("@dxos/util");
-var SpaceServiceImpl = class {
-  constructor(serviceContext) {
-    this.serviceContext = serviceContext;
-    this.inviteeInvitations = /* @__PURE__ */ new Map();
-  }
-  subscribeToSpace(request) {
-    return new import_codec_protobuf2.Stream(({ next }) => {
-      next({
-        space: {
-          publicKey: request.spaceKey,
-          isOpen: true,
-          isActive: true,
-          members: []
-        }
-      });
-    });
-  }
-  subscribeSpaces() {
-    return new import_codec_protobuf2.Stream(({ next, ctx }) => {
-      const onUpdate = () => {
-        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).filter((space) => this.serviceContext.dataServiceSubscriptions.getDataService(space.key)).map((space) => ({
-          publicKey: space.key,
-          isOpen: true,
-          isActive: true,
-          members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-            var _a, _b, _c;
-            return {
-              identityKey: member.key,
-              profile: {
-                identityKey: member.key,
-                displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : (0, import_util5.humanize)(member.key)
-              },
-              presence: ((_c = this.serviceContext.identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_client.SpaceMember.PresenceState.ONLINE : import_client.SpaceMember.PresenceState.OFFLINE
-            };
-          })
-        }));
-        (0, import_log11.log)("update", {
-          spaces
-        }, {
-          file: "space.ts",
-          line: 119,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        next({
-          spaces
-        });
-      };
-      setTimeout(async () => {
-        if (!this.serviceContext.dataSpaceManager) {
-          next({
-            spaces: []
-          });
-        }
-        await this.serviceContext.initialized.wait();
-        const subscribeSpaces = () => {
-          for (const space of this.serviceContext.dataSpaceManager.spaces.values()) {
-            if (!this.serviceContext.dataServiceSubscriptions.getDataService(space.key)) {
-              continue;
-            }
-            space.stateUpdate.on(ctx, onUpdate);
-            space.presence.updated.on(ctx, onUpdate);
-          }
-        };
-        this.serviceContext.dataSpaceManager.updated.on(ctx, () => {
-          subscribeSpaces();
-          onUpdate();
-        });
-        subscribeSpaces();
-        onUpdate();
-      });
-    });
-  }
-  async getSpaceDetails(request) {
-    return (0, import_debug4.todo)();
-  }
-  async createSpace() {
-    if (!this.serviceContext.identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
-    }
-    await this.serviceContext.initialized.wait();
-    const space = await this.serviceContext.dataSpaceManager.createSpace();
-    return {
-      publicKey: space.key,
-      isOpen: true,
-      isActive: true
-    };
-  }
-  async cloneSpace(snapshot) {
-    return (0, import_debug4.todo)();
-  }
-  async setSpaceState(request) {
-    return (0, import_debug4.todo)();
-  }
-  async authenticateInvitation(request) {
-    var _a;
-    (0, import_node_assert9.default)(request.processId, "Process ID is missing.");
-    const invitation = this.inviteeInvitations.get(request.processId);
-    (0, import_node_assert9.default)(invitation, "Invitation not found.");
-    (0, import_node_assert9.default)(request.secret, "Secret not provided.");
-    invitation.secret = request.secret;
-    (_a = invitation.secretTrigger) == null ? void 0 : _a.call(invitation);
-  }
-  subscribeMembers(request) {
-    return (0, import_debug4.todo)();
-  }
-  async createSnapshot(request) {
-    return (0, import_debug4.todo)();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/deprecated/profile.ts
-var import_node_assert10 = __toESM(require("node:assert"));
-var import_codec_protobuf3 = require("@dxos/codec-protobuf");
-var import_credentials12 = require("@dxos/credentials");
-var import_debug5 = require("@dxos/debug");
-var ProfileServiceImpl = class {
-  constructor(context) {
-    this.context = context;
-    this.inviteeInvitations = /* @__PURE__ */ new Map();
-  }
-  subscribeProfile() {
-    return new import_codec_protobuf3.Stream(({ next }) => {
-      const emitNext = () => {
-        var _a;
-        return next({
-          profile: this.context.identityManager.identity ? {
-            identityKey: this.context.identityManager.identity.identityKey,
-            deviceKey: this.context.identityManager.identity.deviceKey,
-            displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
-            haloSpace: this.context.identityManager.identity.space.key
-          } : void 0
-        });
-      };
-      emitNext();
-      return this.context.identityManager.stateUpdate.on(emitNext);
-    });
-  }
-  async createProfile(request) {
-    var _a;
-    await this.context.createIdentity({
-      displayName: request.displayName
-    });
-    return {
-      identityKey: this.context.identityManager.identity.identityKey,
-      deviceKey: this.context.identityManager.identity.deviceKey,
-      displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
-      haloSpace: this.context.identityManager.identity.space.key
-    };
-  }
-  async recoverProfile(request) {
-    return (0, import_debug5.todo)();
-    if (!request.seedPhrase) {
-      throw new Error("Recovery SeedPhrase not provided.");
-    }
-  }
-  async signPresentation({ presentation, nonce }) {
-    (0, import_node_assert10.default)(this.context.identityManager.identity, "Identity not initialized.");
-    return await (0, import_credentials12.signPresentation)({
-      presentation,
-      signer: this.context.keyring,
-      signerKey: this.context.identityManager.identity.deviceKey,
-      chain: this.context.identityManager.identity.deviceCredentialChain,
-      nonce
-    });
-  }
-};
-
-// packages/sdk/client-services/src/packlets/deprecated/system.ts
-var SystemServiceImpl = class {
-  constructor({ config, onInit, onStatus, onReset }) {
-    this._config = config;
-    this._onInit = onInit;
-    this._onStatus = onStatus;
-    this._onReset = onReset;
-  }
-  async getConfig() {
-    return this._config.values;
-  }
-  // TODO(burdon): Connect to iframe RPC heartbeat for network status?
-  async getStatus() {
-    return this._onStatus();
-  }
-  async initSession() {
-    await this._onInit();
-  }
-  async reset() {
-    await this._onReset();
-  }
-};
-
 // packages/sdk/client-services/src/packlets/deprecated/tracing.ts
 var TracingServiceImpl = class {
   constructor(_config) {
@@ -2576,23 +2519,70 @@ var TracingServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/devtools/devtools.ts
+// packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async13 = require("@dxos/async");
-var import_codec_protobuf8 = require("@dxos/codec-protobuf");
-
-// packages/sdk/client-services/src/packlets/devtools/feeds.ts
-var import_async12 = require("@dxos/async");
-var import_codec_protobuf4 = require("@dxos/codec-protobuf");
-var import_feed_store4 = require("@dxos/feed-store");
+var import_codec_protobuf3 = require("@dxos/codec-protobuf");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
+var DevicesServiceImpl = class {
+  constructor(_identityManager) {
+    this._identityManager = _identityManager;
+  }
+  updateDevice(request) {
+    throw new Error("Method not implemented.");
+  }
+  queryDevices() {
+    return new import_codec_protobuf3.Stream(({ next }) => {
+      const update = () => {
+        var _a;
+        const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
+        if (!deviceKeys) {
+          next({
+            devices: []
+          });
+        } else {
+          next({
+            devices: Array.from(deviceKeys.values()).map((key) => {
+              var _a2;
+              return {
+                deviceKey: key,
+                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? import_services7.DeviceKind.CURRENT : import_services7.DeviceKind.TRUSTED
+              };
+            })
+          });
+        }
+      };
+      const subscriptions = new import_async13.EventSubscriptions();
+      subscriptions.add(this._identityManager.stateUpdate.on(() => {
+        update();
+        if (this._identityManager.identity) {
+          subscriptions.add(this._identityManager.identity.stateUpdate.on(() => {
+            update();
+          }));
+        }
+      }));
+      update();
+      return () => subscriptions.clear();
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/devtools/devtools.ts
+var import_async15 = require("@dxos/async");
+var import_codec_protobuf8 = require("@dxos/codec-protobuf");
+
+// packages/sdk/client-services/src/packlets/devtools/feeds.ts
+var import_async14 = require("@dxos/async");
+var import_codec_protobuf4 = require("@dxos/codec-protobuf");
+var import_feed_store4 = require("@dxos/feed-store");
 var import_keys7 = require("@dxos/keys");
-var import_util6 = require("@dxos/util");
+var import_util5 = require("@dxos/util");
 var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
   return new import_codec_protobuf4.Stream(({ next }) => {
     if ((feedKeys == null ? void 0 : feedKeys.length) === 0) {
       return;
     }
-    const subscriptions = new import_async12.EventSubscriptions();
-    const feedMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    const subscriptions = new import_async14.EventSubscriptions();
+    const feedMap = new import_util5.ComplexMap(import_keys7.PublicKey.hash);
     const update = () => {
       const { feeds } = feedStore;
       feeds.filter((feed) => !(feedKeys == null ? void 0 : feedKeys.length) || feedKeys.some((feedKey) => feedKey.equals(feed.key))).forEach((feed) => {
@@ -2621,7 +2611,7 @@ var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
     if (!feedKey) {
       return;
     }
-    const subscriptions = new import_async12.EventSubscriptions();
+    const subscriptions = new import_async14.EventSubscriptions();
     const timeout = setTimeout(async () => {
       const feed = feedStore.getFeed(feedKey);
       if (!feed) {
@@ -2762,7 +2752,7 @@ var subscribeToSpaces = (context, { spaceKeys = [] }) => {
 // packages/sdk/client-services/src/packlets/devtools/devtools.ts
 var DevtoolsHostEvents = class {
   constructor() {
-    this.ready = new import_async13.Event();
+    this.ready = new import_async15.Event();
   }
 };
 var DevtoolsServiceImpl = class {
@@ -2846,56 +2836,14 @@ var DevtoolsServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/identity/devices-service-impl.ts
-var import_async14 = require("@dxos/async");
-var import_codec_protobuf9 = require("@dxos/codec-protobuf");
-var DevicesServiceImpl = class {
-  constructor(_identityManager) {
-    this._identityManager = _identityManager;
-  }
-  updateDevice() {
-    throw new Error("Method not implemented.");
-  }
-  queryDevices() {
-    return new import_codec_protobuf9.Stream(({ next }) => {
-      const update = () => {
-        var _a;
-        const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
-        if (!deviceKeys) {
-          next({
-            devices: []
-          });
-        } else {
-          next({
-            devices: Array.from(deviceKeys.values()).map((key) => ({
-              deviceKey: key
-            }))
-          });
-        }
-      };
-      const dispose = new import_async14.EventSubscriptions();
-      dispose.add(this._identityManager.stateUpdate.on(() => {
-        update();
-        if (this._identityManager.identity) {
-          dispose.add(this._identityManager.identity.stateUpdate.on(() => {
-            update();
-          }));
-        }
-      }));
-      update();
-      return () => dispose.clear();
-    });
-  }
-};
-
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var NetworkServiceImpl = class {
   constructor(networkManager) {
     this.networkManager = networkManager;
   }
   subscribeToNetworkStatus() {
-    return new import_codec_protobuf10.Stream(({ next }) => {
+    return new import_codec_protobuf9.Stream(({ next }) => {
       const unsubscribe = this.networkManager.connectionStateChanged.on((state) => next({
         state
       }));
@@ -2911,39 +2859,94 @@ var NetworkServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-var import_async15 = require("@dxos/async");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_async16 = require("@dxos/async");
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug6 = require("@dxos/debug");
-var import_echo_db4 = require("@dxos/echo-db");
+var import_echo_pipeline4 = require("@dxos/echo-pipeline");
+var import_log11 = require("@dxos/log");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_util6 = require("@dxos/util");
 var SpacesServiceImpl = class {
-  constructor(_spaceManager) {
+  constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
+    this._identityManager = _identityManager;
     this._spaceManager = _spaceManager;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    throw new Error();
+    if (!this._identityManager.identity) {
+      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
+    }
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const space = await dataSpaceManager.createSpace();
+    return this._transformSpace(space);
   }
-  querySpaces() {
-    throw new Error();
+  async updateSpace(request) {
+    (0, import_debug6.todo)();
   }
-  queryMembers(query) {
-    throw new Error();
+  querySpaces() {
+    return new import_codec_protobuf10.Stream(({ next, ctx }) => {
+      const onUpdate = async () => {
+        const dataSpaceManager = await this._getDataSpaceManager();
+        const spaces = Array.from(dataSpaceManager.spaces.values()).filter((space) => this._dataServiceSubscriptions.getDataService(space.key)).map((space) => this._transformSpace(space));
+        (0, import_log11.log)("update", {
+          spaces
+        }, {
+          file: "spaces-service.ts",
+          line: 59,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        next({
+          spaces
+        });
+      };
+      setTimeout(async () => {
+        const dataSpaceManager = await this._getDataSpaceManager();
+        const subscriptions = new import_async16.EventSubscriptions();
+        const subscribeSpaces = () => {
+          subscriptions.clear();
+          for (const space of dataSpaceManager.spaces.values()) {
+            if (!this._dataServiceSubscriptions.getDataService(space.key)) {
+              continue;
+            }
+            subscriptions.add(space.stateUpdate.on(ctx, onUpdate));
+            subscriptions.add(space.presence.updated.on(ctx, onUpdate));
+          }
+        };
+        dataSpaceManager.updated.on(ctx, () => {
+          subscribeSpaces();
+          void onUpdate();
+        });
+        ctx.onDispose(() => subscriptions.clear());
+        (0, import_async16.scheduleTask)(ctx, () => {
+          subscribeSpaces();
+          void onUpdate();
+        });
+      });
+      if (!this._identityManager.identity) {
+        next({
+          spaces: []
+        });
+      }
+    });
   }
   queryCredentials({ spaceKey }) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       var _a;
-      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_db4.SpaceNotFoundError(spaceKey));
+      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline4.SpaceNotFoundError(spaceKey));
       const processor = space.spaceState.registerProcessor({
         process: async (credential) => {
           next(credential);
         }
       });
       ctx.onDispose(() => processor.close());
-      (0, import_async15.scheduleTask)(ctx, () => processor.open());
+      (0, import_async16.scheduleTask)(ctx, () => processor.open());
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
     var _a;
-    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_db4.SpaceNotFoundError(spaceKey));
+    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline4.SpaceNotFoundError(spaceKey));
     for (const credential of credentials != null ? credentials : []) {
       await space.controlPipeline.writer.write({
         credential: {
@@ -2952,6 +2955,24 @@ var SpacesServiceImpl = class {
       });
     }
   }
+  _transformSpace(space) {
+    return {
+      spaceKey: space.key,
+      status: space.isOpen ? import_services8.SpaceStatus.ACTIVE : import_services8.SpaceStatus.INACTIVE,
+      members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+        var _a, _b, _c;
+        return {
+          identity: {
+            identityKey: member.key,
+            profile: {
+              displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : (0, import_util6.humanize)(member.key)
+            }
+          },
+          presence: ((_c = this._identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services8.SpaceMember.PresenceState.ONLINE : import_services8.SpaceMember.PresenceState.OFFLINE
+        };
+      })
+    };
+  }
 };
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
@@ -2999,12 +3020,128 @@ var toStorageType = (type) => {
   }
 };
 
+// packages/sdk/client-services/src/packlets/system/system-service.ts
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var SystemServiceImpl = class {
+  constructor({ config, statusUpdate, onUpdateStatus, getCurrentStatus, onReset }) {
+    this._config = config;
+    this._statusUpdate = statusUpdate;
+    this._getCurrentStatus = getCurrentStatus;
+    this._onUpdateStatus = onUpdateStatus;
+    this._onReset = onReset;
+  }
+  async getConfig() {
+    return this._config.values;
+  }
+  async updateStatus({ status }) {
+    await this._onUpdateStatus(status);
+  }
+  queryStatus() {
+    return new import_codec_protobuf11.Stream(({ next }) => {
+      const update = () => {
+        next({
+          status: this._getCurrentStatus()
+        });
+      };
+      update();
+      const unsubscribe = this._statusUpdate.on(() => update());
+      const interval = setInterval(update, 3e3);
+      return () => {
+        clearInterval(interval);
+        unsubscribe();
+      };
+    });
+  }
+  async reset() {
+    await this._onReset();
+  }
+};
+
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-var import_async16 = require("@dxos/async");
+var import_async18 = require("@dxos/async");
 var import_log12 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager3 = require("@dxos/network-manager");
+var import_rpc3 = require("@dxos/rpc");
+var import_util7 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+var import_node_assert11 = __toESM(require("node:assert"));
+var import_async17 = require("@dxos/async");
+var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
 var import_rpc2 = require("@dxos/rpc");
+
+// packages/sdk/client-services/src/packlets/vault/services.ts
+var import_protocols7 = require("@dxos/protocols");
+var iframeServiceBundle = {
+  IframeService: import_protocols7.schema.getService("dxos.iframe.IframeService"),
+  BridgeService: import_protocols7.schema.getService("dxos.mesh.bridge.BridgeService")
+};
+var workerServiceBundle = {
+  WorkerService: import_protocols7.schema.getService("dxos.iframe.WorkerService")
+};
+var appServiceBundle = {
+  AppService: import_protocols7.schema.getService("dxos.iframe.AppService")
+};
+var shellServiceBundle = {
+  ShellService: import_protocols7.schema.getService("dxos.iframe.ShellService")
+};
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+var ShellRuntimeImpl = class {
+  constructor(_port) {
+    this._port = _port;
+    this.layoutUpdate = new import_async17.Event();
+    this._layout = import_iframe.ShellLayout.DEFAULT;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    (0, import_node_assert11.default)(this._appRpc, "runtime not open");
+    await this._appRpc.rpc.AppService.setContext(context);
+  }
+  async open() {
+    this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
+      requested: appServiceBundle,
+      exposed: shellServiceBundle,
+      handlers: {
+        ShellService: {
+          setLayout: async (request) => {
+            this._layout = request.layout;
+            this._invitationCode = request.invitationCode;
+            this._spaceKey = request.spaceKey;
+            this.layoutUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._appRpc.open();
+  }
+  async close() {
+    var _a;
+    await ((_a = this._appRpc) == null ? void 0 : _a.close());
+    this._appRpc = void 0;
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
 var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -3017,11 +3154,12 @@ var __decorate3 = function(decorators, target, key, desc) {
 };
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
-  constructor({ configProvider, appPort }) {
+  constructor({ configProvider, appPort, shellPort }) {
     this._transportFactory = (0, import_network_manager3.createWebRTCTransportFactory)();
-    this._ready = new import_async16.Trigger();
+    this._ready = new import_async18.Trigger();
     this._configProvider = configProvider;
     this._appPort = appPort;
+    this._shellPort = shellPort;
     this._getService = async (find) => {
       const error = await this._ready.wait();
       if (error) {
@@ -3033,16 +3171,26 @@ var IFrameHostRuntime = class {
       }
       return service;
     };
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
+  }
+  get services() {
+    return this._clientServices;
+  }
+  get shell() {
+    return this._shellRuntime;
   }
   async start() {
+    var _a;
     (0, import_log12.log)("starting...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 63,
+      line: 81,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
-      this._config = await this._configProvider();
+      this._config = await (0, import_util7.getAsyncValue)(this._configProvider);
       const signalServer = this._config.get("runtime.services.signal.server");
       this._clientServices = new ClientServicesHost({
         lockKey: LOCK_KEY,
@@ -3055,17 +3203,16 @@ var IFrameHostRuntime = class {
           transportFactory: this._transportFactory
         })
       });
-      this._clientRpc = (0, import_rpc2.createProtoRpcPeer)({
+      this._clientRpc = (0, import_rpc3.createProtoRpcPeer)({
         exposed: clientServiceBundle,
         handlers: {
           DataService: async () => await this._getService((services) => services.DataService),
+          DeviceInvitationsService: async () => await this._getService((services) => services.DeviceInvitationsService),
           DevicesService: async () => await this._getService((services) => services.DevicesService),
           DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
-          HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
           NetworkService: async () => await this._getService((services) => services.NetworkService),
-          ProfileService: async () => await this._getService((services) => services.ProfileService),
+          IdentityService: async () => await this._getService((services) => services.IdentityService),
           SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
-          SpaceService: async () => await this._getService((services) => services.SpaceService),
           SpacesService: async () => await this._getService((services) => services.SpacesService),
           SystemService: async () => await this._getService((services) => services.SystemService),
           TracingService: async () => await this._getService((services) => services.TracingService)
@@ -3074,12 +3221,13 @@ var IFrameHostRuntime = class {
       });
       await Promise.all([
         this._clientServices.open(),
-        this._clientRpc.open()
+        this._clientRpc.open(),
+        (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
       (0, import_log12.log)("started", {}, {
         file: "iframe-host-runtime.ts",
-        line: 99,
+        line: 116,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3087,24 +3235,26 @@ var IFrameHostRuntime = class {
       this._ready.wake(err);
       import_log12.log.catch(err, {}, {
         file: "iframe-host-runtime.ts",
-        line: 102,
+        line: 119,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     }
   }
   async stop() {
+    var _a;
     (0, import_log12.log)("stopping...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 107,
+      line: 124,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._clientRpc.close();
     await this._clientServices.close();
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
     (0, import_log12.log)("stopped", {}, {
       file: "iframe-host-runtime.ts",
-      line: 110,
+      line: 128,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3116,21 +3266,17 @@ __decorate3([
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
 var import_network_manager4 = require("@dxos/network-manager");
-var import_rpc3 = require("@dxos/rpc");
+var import_rpc4 = require("@dxos/rpc");
 
-// packages/sdk/client-services/src/packlets/vault/services.ts
-var import_protocols7 = require("@dxos/protocols");
-var iframeServiceBundle = {
-  IframeService: import_protocols7.schema.getService("dxos.iframe.IframeService"),
-  BridgeService: import_protocols7.schema.getService("dxos.mesh.bridge.BridgeService")
-};
-var workerServiceBundle = {
-  WorkerService: import_protocols7.schema.getService("dxos.iframe.WorkerService")
-};
+// packages/sdk/client-services/src/packlets/vault/shell-controller.ts
+var import_async19 = require("@dxos/async");
+var import_log13 = require("@dxos/log");
+var import_iframe2 = require("@dxos/protocols/proto/dxos/iframe");
+var import_rpc5 = require("@dxos/rpc");
 
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-var import_async17 = require("@dxos/async");
-var import_log13 = require("@dxos/log");
+var import_async20 = require("@dxos/async");
+var import_log14 = require("@dxos/log");
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -3138,7 +3284,7 @@ var Message;
 var VaultResourceLock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new import_async17.Trigger();
+    this._releaseTrigger = new import_async20.Trigger();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -3149,7 +3295,7 @@ var VaultResourceLock = class {
       message: Message.ACQUIRING
     });
     try {
-      await (0, import_async17.asyncTimeout)(this._requestLock(), 3e3);
+      await (0, import_async20.asyncTimeout)(this._requestLock(), 3e3);
     } catch (e) {
       await this._requestLock(true);
     }
@@ -3163,7 +3309,7 @@ var VaultResourceLock = class {
     }
   }
   async _requestLock(steal = false) {
-    (0, import_log13.log)("requesting lock...", {
+    (0, import_log14.log)("requesting lock...", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3171,23 +3317,23 @@ var VaultResourceLock = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new import_async17.Trigger();
+    const acquired = new import_async20.Trigger();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       var _a, _b;
       await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
       acquired.wake();
-      this._releaseTrigger = new import_async17.Trigger();
+      this._releaseTrigger = new import_async20.Trigger();
       await this._releaseTrigger.wait();
-      (0, import_log13.log)("releasing lock...", {}, {
+      (0, import_log14.log)("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 65,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      (0, import_log13.log)("released lock", {}, {
+      (0, import_log14.log)("released lock", {}, {
         file: "vault-resource-lock.ts",
         line: 67,
         scope: this,
@@ -3198,7 +3344,7 @@ var VaultResourceLock = class {
       await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
     });
     await acquired.wait();
-    (0, import_log13.log)("recieved lock", {
+    (0, import_log14.log)("recieved lock", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3210,17 +3356,17 @@ var VaultResourceLock = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var import_async19 = require("@dxos/async");
-var import_log15 = require("@dxos/log");
+var import_async22 = require("@dxos/async");
+var import_log16 = require("@dxos/log");
 var import_messaging2 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert11 = __toESM(require("node:assert"));
-var import_async18 = require("@dxos/async");
-var import_log14 = require("@dxos/log");
-var import_rpc4 = require("@dxos/rpc");
-var import_util7 = require("@dxos/util");
+var import_node_assert12 = __toESM(require("node:assert"));
+var import_async21 = require("@dxos/async");
+var import_log15 = require("@dxos/log");
+var import_rpc6 = require("@dxos/rpc");
+var import_util8 = require("@dxos/util");
 var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -3232,33 +3378,38 @@ var __decorate4 = function(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var WorkerSession = class {
-  constructor({ getService, systemPort, appPort, options = {
+  constructor({ getService, systemPort, appPort, shellPort, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new import_async18.Trigger();
-    this.onClose = new import_util7.Callback();
-    (0, import_node_assert11.default)(options);
-    (0, import_node_assert11.default)(getService);
+    this._startTrigger = new import_async21.Trigger();
+    this.onClose = new import_util8.Callback();
+    (0, import_node_assert12.default)(options);
+    (0, import_node_assert12.default)(getService);
     this._options = options;
     this._getService = getService;
-    this._clientRpc = (0, import_rpc4.createProtoRpcPeer)({
+    const handlers = {
+      DataService: () => this._getService((services) => services.DataService),
+      DeviceInvitationsService: () => this._getService((services) => services.DeviceInvitationsService),
+      DevicesService: () => this._getService((services) => services.DevicesService),
+      DevtoolsHost: () => this._getService((services) => services.DevtoolsHost),
+      NetworkService: () => this._getService((services) => services.NetworkService),
+      IdentityService: () => this._getService((services) => services.IdentityService),
+      SpaceInvitationsService: () => this._getService((services) => services.SpaceInvitationsService),
+      SpacesService: () => this._getService((services) => services.SpacesService),
+      SystemService: () => this._getService((services) => services.SystemService),
+      TracingService: () => this._getService((services) => services.TracingService)
+    };
+    this._clientRpc = (0, import_rpc6.createProtoRpcPeer)({
       exposed: clientServiceBundle,
-      handlers: {
-        DataService: async () => await this._getService((services) => services.DataService),
-        DevicesService: async () => await this._getService((services) => services.DevicesService),
-        DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
-        HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
-        NetworkService: async () => await this._getService((services) => services.NetworkService),
-        ProfileService: async () => await this._getService((services) => services.ProfileService),
-        SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
-        SpaceService: async () => await this._getService((services) => services.SpaceService),
-        SpacesService: async () => await this._getService((services) => services.SpacesService),
-        SystemService: async () => await this._getService((services) => services.SystemService),
-        TracingService: async () => await this._getService((services) => services.TracingService)
-      },
+      handlers,
       port: appPort
     });
-    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
+    this._shellClientRpc = (0, import_rpc6.createProtoRpcPeer)({
+      exposed: clientServiceBundle,
+      handlers,
+      port: shellPort
+    });
+    this._iframeRpc = (0, import_rpc6.createProtoRpcPeer)({
       requested: iframeServiceBundle,
       exposed: workerServiceBundle,
       handlers: {
@@ -3272,9 +3423,9 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log14.log.catch(err, {}, {
+                import_log15.log.catch(err, {}, {
                   file: "worker-session.ts",
-                  line: 90,
+                  line: 91,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -3290,15 +3441,16 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log14.log.info("opening..", {}, {
+    import_log15.log.info("opening..", {}, {
       file: "worker-session.ts",
-      line: 104,
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await Promise.all([
       this._clientRpc.open(),
-      this._iframeRpc.open()
+      this._iframeRpc.open(),
+      this._maybeOpenShell()
     ]);
     await this._startTrigger.wait({
       timeout: 3e3
@@ -3307,20 +3459,20 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        import_log14.log.warn("Heartbeat failed", {
+        import_log15.log.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
-          line: 116,
+          line: 117,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         try {
           await this.close();
         } catch (err) {
-          import_log14.log.catch(err, {}, {
+          import_log15.log.catch(err, {}, {
             file: "worker-session.ts",
-            line: 120,
+            line: 121,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3329,18 +3481,18 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    import_log14.log.info("closing..", {}, {
+    import_log15.log.info("closing..", {}, {
       file: "worker-session.ts",
-      line: 127,
+      line: 128,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log14.log.catch(err, {}, {
+      import_log15.log.catch(err, {}, {
         file: "worker-session.ts",
-        line: 131,
+        line: 132,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3353,9 +3505,21 @@ var WorkerSession = class {
       this._iframeRpc.close()
     ]);
   }
+  async _maybeOpenShell() {
+    try {
+      await (0, import_async21.asyncTimeout)(this._shellClientRpc.open(), 1e3);
+    } catch (e) {
+      import_log15.log.info("No shell connected.", {}, {
+        file: "worker-session.ts",
+        line: 146,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
 };
 __decorate4([
-  import_log14.logInfo
+  import_log15.logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/services/service-registry.ts
@@ -3387,8 +3551,10 @@ var ClientServicesHost = class {
     // TODO(burdon): Create ApolloLink abstraction (see Client).
     networkManager,
     storage = createStorageObjects(config.get("runtime.client.storage", {})).storage,
+    // TODO(wittjosiah): Turn this on by default.
     lockKey
   }) {
+    this._statusUpdate = new import_async23.Event();
     this._open = false;
     this._config = config;
     this._modelFactory = modelFactory;
@@ -3401,23 +3567,19 @@ var ClientServicesHost = class {
     }) : void 0;
     this._systemService = new SystemServiceImpl({
       config: this._config,
-      onInit: async () => {
-        var _a;
-        await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-      },
-      onStatus: async () => {
-        if (!this.isOpen) {
-          return {
-            status: import_client2.Status.INACTIVE
-          };
+      statusUpdate: this._statusUpdate,
+      getCurrentStatus: () => this.isOpen ? import_services16.SystemStatus.ACTIVE : import_services16.SystemStatus.INACTIVE,
+      onUpdateStatus: async (status) => {
+        var _a, _b;
+        if (!this.isOpen && status === import_services16.SystemStatus.ACTIVE) {
+          await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+        } else if (this.isOpen && status === import_services16.SystemStatus.INACTIVE) {
+          await ((_b = this._resourceLock) == null ? void 0 : _b.release());
         }
-        return {
-          status: import_client2.Status.ACTIVE
-        };
       },
       onReset: async () => {
-        var _a;
-        await ((_a = this._serviceContext) == null ? void 0 : _a.reset());
+        (0, import_node_assert13.default)(this._serviceContext, "service host is closed");
+        await this._serviceContext.reset();
       }
     });
     this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
@@ -3434,22 +3596,23 @@ var ClientServicesHost = class {
     return this._serviceRegistry.services;
   }
   async open() {
-    var _a;
+    var _a, _b;
     if (this._open) {
       return;
     }
-    (0, import_log16.log)("opening...", {}, {
+    (0, import_log17.log)("opening...", {}, {
       file: "service-host.ts",
-      line: 125,
+      line: 133,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
     this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
     this._serviceRegistry.setServices({
-      // TODO(burdon): Move to new protobuf definitions.
       SystemService: this._systemService,
-      HaloInvitationsService: new HaloInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.haloInvitations),
+      IdentityService: new IdentityServiceImpl(this._serviceContext),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
+      DeviceInvitationsService: new DeviceInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.deviceInvitations),
       SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
         var _a2;
         return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceInvitations not initialized"));
@@ -3457,13 +3620,13 @@ var ClientServicesHost = class {
         var _a2;
         return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceManager not initialized"));
       }),
-      SpacesService: new SpacesServiceImpl(this._serviceContext.spaceManager),
-      DataService: new import_echo_db5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
+        await this._serviceContext.initialized.wait();
+        return this._serviceContext.dataSpaceManager;
+      }),
+      DataService: new import_echo_pipeline5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
       NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager),
       // TODO(burdon): Move to new protobuf definitions.
-      ProfileService: new ProfileServiceImpl(this._serviceContext),
-      // TODO(burdon): Port old SubscribeSpaces to QueryServices>
-      SpaceService: new SpaceServiceImpl(this._serviceContext),
       TracingService: new TracingServiceImpl(this._config),
       DevtoolsHost: new DevtoolsServiceImpl({
         events: new DevtoolsHostEvents(),
@@ -3473,12 +3636,13 @@ var ClientServicesHost = class {
     });
     await this._serviceContext.open();
     this._open = true;
-    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log16.log)("opened", {
+    this._statusUpdate.emit();
+    const deviceKey = (_b = this._serviceContext.identityManager.identity) == null ? void 0 : _b.deviceKey;
+    (0, import_log17.log)("opened", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 172,
+      line: 186,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3489,11 +3653,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log16.log)("closing...", {
+    (0, import_log17.log)("closing...", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 181,
+      line: 195,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3502,11 +3666,12 @@ var ClientServicesHost = class {
     });
     await this._serviceContext.close();
     this._open = false;
-    (0, import_log16.log)("closed", {
+    this._statusUpdate.emit();
+    (0, import_log17.log)("closed", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 185,
+      line: 200,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3514,9 +3679,9 @@ var ClientServicesHost = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-proxy.ts
-var import_async20 = require("@dxos/async");
+var import_async24 = require("@dxos/async");
 var import_errors2 = require("@dxos/errors");
-var import_rpc5 = require("@dxos/rpc");
+var import_rpc7 = require("@dxos/rpc");
 
 // packages/sdk/client-services/src/packlets/testing/test-builder.ts
 var createServiceHost = (config, signalManagerContext) => {
@@ -3587,18 +3752,18 @@ var TestPeer = class {
         root: this.storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_db6.valueEncoding
+          valueEncoding: import_echo_pipeline6.valueEncoding
         }
       })
     });
   }
   get metadataStore() {
     var _a, _b;
-    return (_b = (_a = this._props).metadataStore) != null ? _b : _a.metadataStore = new import_echo_db6.MetadataStore(this.storage.createDirectory("metadata"));
+    return (_b = (_a = this._props).metadataStore) != null ? _b : _a.metadataStore = new import_echo_pipeline6.MetadataStore(this.storage.createDirectory("metadata"));
   }
   get snapshotStore() {
     var _a, _b;
-    return (_b = (_a = this._props).snapshotStore) != null ? _b : _a.snapshotStore = new import_echo_db6.SnapshotStore(this.storage.createDirectory("snapshots"));
+    return (_b = (_a = this._props).snapshotStore) != null ? _b : _a.snapshotStore = new import_echo_pipeline6.SnapshotStore(this.storage.createDirectory("snapshots"));
   }
   get networkManager() {
     var _a, _b;
@@ -3609,7 +3774,7 @@ var TestPeer = class {
   }
   get spaceManager() {
     var _a, _b;
-    return (_b = (_a = this._props).spaceManager) != null ? _b : _a.spaceManager = new import_echo_db6.SpaceManager({
+    return (_b = (_a = this._props).spaceManager) != null ? _b : _a.spaceManager = new import_echo_pipeline6.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager
     });
@@ -3629,49 +3794,6 @@ var createSigningContext = async (keyring) => {
     // No-op.
   };
 };
-
-// packages/sdk/client-services/src/packlets/testing/invitation-utils.ts
-var import_node_assert12 = __toESM(require("node:assert"));
-var import_async21 = require("@dxos/async");
-var import_debug8 = require("@dxos/debug");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
-var performInvitation = async (host, guest, context) => {
-  const done1 = new import_async21.Trigger();
-  const done2 = new import_async21.Trigger();
-  const observable1 = await host.createInvitation(context, {
-    type: import_services12.Invitation.Type.INTERACTIVE_TESTING
-  });
-  observable1.subscribe({
-    onConnecting: async (invitation1) => {
-      const observable2 = await guest.acceptInvitation(invitation1, {
-        type: import_services12.Invitation.Type.INTERACTIVE_TESTING
-      });
-      observable2.subscribe({
-        onConnecting: async (invitation2) => {
-          (0, import_node_assert12.default)(invitation1.swarmKey.equals(invitation2.swarmKey));
-        },
-        onConnected: async (invitation2) => {
-        },
-        onSuccess: (invitation) => {
-          done2.wake(invitation);
-        },
-        onCancelled: () => (0, import_debug8.raise)(new Error()),
-        onTimeout: (err) => (0, import_debug8.raise)(err),
-        onError: (err) => (0, import_debug8.raise)(err)
-      });
-    },
-    onConnected: async (invitation1) => {
-    },
-    onCancelled: () => (0, import_debug8.raise)(new Error("cancelled")),
-    onSuccess: (invitation) => {
-      done1.wake(invitation);
-    },
-    onTimeout: (err) => (0, import_debug8.raise)(err),
-    onError: (err) => (0, import_debug8.raise)(err)
-  });
-  await done1.wait();
-  await done2.wait();
-};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   TestBuilder,